Online Reputation and Personal Information Protection

Avner Levin (Ryerson University)^{Footnote 1}

August 2016

Note: This submission was contributed by the author(s) to the Office of the Privacy Commissioner of Canada’s Consultation on Online Reputation.

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

---

Introduction

This short paper is submitted in response to the OPC’s (excellent) discussion paper and call for essays on the topic of online reputation. The paper addresses questions 2, 3 and 5 posed in the consultation. It attempts to offer solutions for the issue of online reputational risk, to discuss the right to be forgotten and its applicability in Canada, and to suggest the roles that the OPC, Government and the private sector can play in the protection of reputation online.

Solutions and the Right to be Forgotten

The discussion paper asks contributors to identify reputational risk solutions from a variety of perspectives — practical, technical, policy and legal. While that division of perspectives is undoubtedly helpful it is even more important to recognize that reputation—control over personal information—will only be achieved through innovative solutions that combine these perspectives and use them to build one upon another. The implementation of the Google Spain decision is itself an important—paradigmatic even—example of how solutions should be implemented in Canada and arguably in other jurisdictions.

Viewed from this perspective the novelty and importance of the Right to be Forgotten decision in the EU is not, arguably, in the remarkable legal precedent that was set but in the decision made in its aftermath by Google to develop an online form for the submission of future removal requests. Google could have chosen to let future complainants litigate, and Google could have chosen to fight each individual complaint through the respective data protection commission process and subsequent court process. Instead, Google responded to a legal “solution” with a technological (and practical) “solution” of the creation of an online interface for complaints, and an adjudication process within Google, based upon the principles of the Google Spain decision, to determine the outcome of each complaint. As noted in the discussion paper the decision by Google to “open” the process has resulted in hundreds of thousands of removal requests within a short period of time.

It is true that Google’s solution can be improved upon, and it is true that Google has been criticized for some aspects of its solution, such as the limitation of removals to the jurisdictionally–related version of the search engine, and the exclusion of stakeholders external to Google from the internal adjudication process, but these critiques pale in comparison with the significance of offering millions of users a cheap and easy remedial tool. There is no question that these hundreds of thousands of removal requests would not have been submitted through a traditional litigation or commissioner–complaint process.

Herein lies the paradigmatic importance of Google Spain. A complaint process led to litigation which led to a judicial remedy which led to a practical and technical solution that transformed the landscape of reputation in most of Europe in one fell swoop. In many cases, of course, technological solutions have been developed and adopted by corporations without a prompting legal or regulatory decision. Google itself, for example, decided in response to repeated advocacy, to remove “revenge porn” websites from its search results, and has modified its online removal request form (worldwide) to allow individuals to request the removal of such images.^{Footnote 2} And of course for some legal and commercial interests—such as intellectual property claims—a technical solution has been in place for many years.

Many technological and practical solutions are therefore already available within Canada for reputation concerns through the platforms of Google, Microsoft and social media giants such as Facebook. However, with respect to other removal requests it appears from the discussion paper that decisions of the private sector on removal requests have been made on an ad–hoc and somewhat voluntary basis, and largely in response to the efforts of the OPC in some matters which the OPC saw fit to intervene. The discussion paper notes that the OPC sees its mandate on reputation as limited by jurisdictional concerns about PIPEDA’s scope and reach. In order to advance the protection of reputation in Canada it is probably best to first discuss how the issue of reputation protection should be framed and understood.

Reputation, Privacy and Personal Information Protection

While we have grown accustomed to treating personal information protection as an aspect of privacy, it is worth noting in the context of online reputation that the two notions do not fully overlap, and that there are legitimate reasons and values on the basis of which individuals would wish to protect their personal information that are conceptually distinct from privacy. Among such values are reputation, and more essentially, human dignity. Research in this area by many scholars has demonstrated, for example, that when young adults articulate what they term as “privacy concerns” they are often concerned about the formation and the expression of their identity, as noted in the discussion paper.

It is important to base the protection of reputation directly on the notion of personal information protection since at the basis of personal information protection is the idea of individual control over personal information, and agreement to the specific purposes of processing of personal information, expressed by the Germans as the idea of “informational self–determination.”^{Footnote 3} Furthermore, understanding the discussion over reputation as a discussion over personal information and how it is controlled, allows us to avoid the pitfalls of considering or grappling with the implications of labelling personal information that is widely available online as ’private’ in the sense that it is somehow secret, or confidential, or very limited in its dissemination.

Understanding the discussion over reputation as a discussion about control is important in another sense. The EU generally refers to organizations and bodies that process personal information as “controllers”,^{Footnote 4} and so it is clear that a crucial aspect of the debate over online reputation online is the debate who controls, in what manner, and in what circumstances, the personal information that forms this reputation. Such a framing should, in turn, assure the OPC that a clear mandate for intervention on the basis of PIPEDA does exist not only against information controllers that seek to profit from the reputation they create, such as Globe24h, but more importantly against intermediaries that are commercial in nature, present in Canada, and play a much more significant and amplifying role in terms of bringing reputational–relevant information to the attention of individuals.

Key Players and their Role

To some extent the role of the OPC is and will continue to be limited by the lack of order–making powers. Much ink has been spilt over the need for the OPC to have such powers. The OPC should very much continue to advocate and press for legal changes that would bring about such powers. In the absence of such powers the OPC should not shy away from investigating, finding and if necessary asking the court for an order that the Right to be Forgotten exists in Canada as well. The litigation against Globe24h will hopefully help set a precedent in this regard.^{Footnote 5}

At the same time the OPC should advocate for the creation of more hybrid regulatory—driven/technologically—enabled solutions such as online removal–request forms that should highly appeal to Canadians—and to the private sector—because of their low costs and ease of use. Creating online, even partially automated or algorithmic–run processes would improve the management of reputation for a great number of individuals and would alleviate the need for ad–hoc interventions on behalf of the regulator.

Members of the private sector—the main platforms through which individuals access information and socialize online—should continue to demonstrate and develop their commitment to offer individuals control over their personal information. Such protective features are increasingly both touted and demanded by individuals. Companies should therefore find technological solutions attractive, affordable and pre–emptive. In the absence of regulatory enforcement companies should act in a socially responsible and ethical manner by proactively and voluntarily creating such solutions.

Conclusion

There will be much resistance, no doubt, to any cooperation between the regulator and the private sector, and especially one that would create new, hybrid, innovative remedies that could be perceived as bypassing the traditional and legislated complaint and remedy process. Indeed, members of the legal profession have already expressed concern over the implications of allowing a corporation to balance constitutional and quasi–constitutional values. It is important for the OPC not to put too much weight on such arguments and to remember that the OPC serves the public. In an era where legal representation and legal remedies are increasingly out of reach of average, middle–class Canadians, let vulnerable individuals, there is a great need for innovative, easy and affordable solutions that will put some control over their reputation and their personal information back in the hands of Canadians.